Multiple vulnerabilities in PaperCut NG/MF

Published: 2024-03-19 | Updated: 2024-06-19

Risk	Medium
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2024-1222 CVE-2024-1654 CVE-2024-1884 CVE-2024-1882 CVE-2024-1883 CVE-2024-1223 CVE-2024-1221
CWE-ID	CWE-284 CWE-264 CWE-918 CWE-94 CWE-79 CWE-200
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	PaperCut MF Other software / Other software solutions PaperCut NG Other software / Other software solutions
Vendor	PaperCut Software

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU87599

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1222

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions at certain API endpoints. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.0.1 - 23.0.6

PaperCut NG: 20.0.1 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024
http://www.zerodayinitiative.com/advisories/ZDI-24-782/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU87600

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1654

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions within the admin console. A remote authenticated administrator can perform unauthorized write operations and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.1.5 - 23.0.6

PaperCut NG: 20.1.9 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU87606

Risk: Medium

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1884

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.1.9 - 23.0.6

PaperCut NG: 20.1.9 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024
http://www.zerodayinitiative.com/advisories/ZDI-24-783/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Code Injection

EUVDB-ID: #VU87608

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1882

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote administrator can execute code on the PaperCut Application Server in the context of SYSTEM (Windows) or the papercut user (macOS/Linux).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.1.9 - 23.0.6

PaperCut NG: 20.1.9 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024
http://www.zerodayinitiative.com/advisories/ZDI-24-785/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Cross-site scripting

EUVDB-ID: #VU87610

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1883

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.1.9 - 23.0.6

PaperCut NG: 20.1.9 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024
http://www.zerodayinitiative.com/advisories/ZDI-24-784/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU87612

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1223

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application's API. A remote user can gain unauthorized access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.1.9 - 23.0.6

PaperCut NG: 20.1.9 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU87613

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1221

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to improper access restrictions within the API endpoints. A remote user can expose files on a Linux/macOS PaperCut NG/MF server.

Note, Windows PaperCut NG/MF application server is not affected by this vulnerability.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

PaperCut MF: 20.1.9 - 23.0.6

PaperCut NG: 20.1.9 - 23.0.6

CPE2.3

External links

http://www.papercut.com/kb/Main/Security-Bulletin-March-2024

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.